nestforge-generator 0.1.0

package/templates/prisma/src/auth/strategies/google.strategy.ts

@@ -0,0 +1,43 @@
+import { Injectable } from '@nestjs/common';
+import { PassportStrategy } from '@nestjs/passport';
+import { Strategy, Profile, VerifyCallback } from 'passport-google-oauth20';
+import { ConfigService } from '@nestjs/config';
+
+export interface OAuthProfile {
+    provider: 'google' | 'github';
+    providerUserId: string;
+    email: string;
+    name: string;
+}
+
+@Injectable()
+export class GoogleStrategy extends PassportStrategy(Strategy, 'google') {
+    constructor(configService: ConfigService) {
+        super({
+            clientID: configService.getOrThrow<string>('GOOGLE_CLIENT_ID'),
+            clientSecret: configService.getOrThrow<string>(
+                'GOOGLE_CLIENT_SECRET',
+            ),
+            callbackURL: `${configService.getOrThrow<string>(
+                'APP_URL',
+            )}/auth/google/callback`,
+            scope: ['email', 'profile'],
+        });
+    }
+
+    async validate(
+        _accessToken: string,
+        _refreshToken: string,
+        profile: Profile,
+        done: VerifyCallback,
+    ) {
+        const oauthProfile: OAuthProfile = {
+            provider: 'google',
+            providerUserId: profile.id,
+            email: profile.emails?.[0]?.value ?? '',
+            name: profile.displayName,
+        };
+
+        done(null, oauthProfile);
+    }
+}

package/templates/prisma/src/auth/strategies/jwt.strategy.ts

@@ -0,0 +1,25 @@
+// nestforge:feature-file:auth:token
+import { Injectable } from '@nestjs/common';
+import { PassportStrategy } from '@nestjs/passport';
+import { ExtractJwt, Strategy } from 'passport-jwt';
+
+export interface JwtPayload {
+  sub: string;
+  email: string;
+  role: string;
+}
+
+@Injectable()
+export class JwtStrategy extends PassportStrategy(Strategy) {
+  constructor() {
+    super({
+      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
+      ignoreExpiration: false,
+      secretOrKey: process.env.JWT_ACCESS_SECRET as string,
+    });
+  }
+
+  async validate(payload: JwtPayload) {
+    return { id: payload.sub, email: payload.email, role: payload.role };
+  }
+}

package/templates/prisma/src/auth/token.service.ts

@@ -0,0 +1,84 @@
+// nestforge:feature-file:auth:token
+import { Injectable, UnauthorizedException } from '@nestjs/common';
+import { JwtService } from '@nestjs/jwt';
+import { createHash } from 'crypto';
+import { PrismaService } from '../database/prisma.service';
+
+@Injectable()
+export class TokenService {
+    constructor(
+        private readonly prisma: PrismaService,
+        private readonly jwtService: JwtService,
+    ) { }
+
+    async issueTokens(userId: string, email: string, role: string) {
+        const payload = { sub: userId, email, role };
+
+        const accessToken = this.jwtService.sign(payload, {
+            secret: process.env.JWT_ACCESS_SECRET,
+            expiresIn: process.env.JWT_ACCESS_EXPIRES_IN ?? '15m',
+        });
+
+        const refreshToken = this.jwtService.sign(payload, {
+            secret: process.env.JWT_REFRESH_SECRET,
+            expiresIn: process.env.JWT_REFRESH_EXPIRES_IN ?? '7d',
+        });
+
+        const expiresAt = new Date();
+        expiresAt.setDate(expiresAt.getDate() + 7);
+
+        await this.prisma.refreshToken.create({
+            data: {
+                tokenHash: this.hashToken(refreshToken),
+                userId,
+                expiresAt,
+            },
+        });
+
+        return { accessToken, refreshToken };
+    }
+
+    async refresh(refreshToken: string) {
+        const tokenHash = this.hashToken(refreshToken);
+
+        const stored = await this.prisma.refreshToken.findUnique({
+            where: { tokenHash },
+            include: { user: true },
+        });
+
+        if (!stored || stored.revokedAt || stored.expiresAt < new Date()) {
+            throw new UnauthorizedException('Refresh token inválido ou expirado');
+        }
+
+        await this.prisma.refreshToken.update({
+            where: { id: stored.id },
+            data: { revokedAt: new Date() },
+        });
+
+        return this.issueTokens(
+            stored.user.id,
+            stored.user.email,
+            stored.user.role,
+        );
+    }
+
+    async logout(refreshToken: string) {
+        const tokenHash = this.hashToken(refreshToken);
+
+        await this.prisma.refreshToken.updateMany({
+            where: {
+                tokenHash,
+                revokedAt: null,
+            },
+            data: {
+                revokedAt: new Date(),
+            },
+        });
+
+        return { message: 'Logout realizado com sucesso' };
+    }
+
+    private hashToken(token: string): string {
+        return createHash('sha256').update(token).digest('hex');
+    }
+}

package/templates/prisma/src/common/constants/permissions.ts

@@ -0,0 +1,8 @@
+// nestforge:feature-file:rbac
+export enum Permission {
+    UserCreate = 'user:create',
+    UserRead = 'user:read',
+    UserUpdate = 'user:update',
+    UserDelete = 'user:delete',
+    ReportRead = 'report:read',
+}

package/templates/prisma/src/common/constants/role-permissions.ts

@@ -0,0 +1,9 @@
+// nestforge:feature-file:rbac
+import { Role } from '@prisma/client';
+import { Permission } from './permissions';
+
+export const ROLE_PERMISSIONS: Record<Role, Permission[]> = {
+    [Role.ADMIN]: Object.values(Permission),
+    [Role.MANAGER]: [Permission.UserRead, Permission.UserUpdate, Permission.ReportRead],
+    [Role.USER]: [Permission.UserRead],
+};

package/templates/prisma/src/common/decorators/current-user.decorator.ts

@@ -0,0 +1,8 @@
+import { createParamDecorator, ExecutionContext } from '@nestjs/common';
+
+export const CurrentUser = createParamDecorator(
+  (data: unknown, ctx: ExecutionContext) => {
+    const request = ctx.switchToHttp().getRequest();
+    return request.user;
+  },
+);

package/templates/prisma/src/common/decorators/permissions.decorator.ts

@@ -0,0 +1,7 @@
+// nestforge:feature-file:rbac
+import { SetMetadata } from '@nestjs/common';
+import { Permission } from '../constants/permissions';
+
+export const PERMISSIONS_KEY = 'permissions';
+export const Permissions = (...permissions: Permission[]) =>
+    SetMetadata(PERMISSIONS_KEY, permissions);

package/templates/prisma/src/common/decorators/public.decorator.ts

@@ -0,0 +1,4 @@
+import { SetMetadata } from '@nestjs/common';
+
+export const IS_PUBLIC_KEY = 'isPublic';
+export const Public = () => SetMetadata(IS_PUBLIC_KEY, true);

package/templates/prisma/src/common/decorators/roles.decorator.ts

@@ -0,0 +1,6 @@
+// nestforge:feature-file:rbac
+import { SetMetadata } from '@nestjs/common';
+import { Role } from '@prisma/client';
+
+export const ROLES_KEY = 'roles';
+export const Roles = (...roles: Role[]) => SetMetadata(ROLES_KEY, roles);

package/templates/prisma/src/common/filters/http-exception.filter.ts

@@ -0,0 +1,34 @@
+import {
+  ArgumentsHost,
+  Catch,
+  ExceptionFilter,
+  HttpException,
+  HttpStatus,
+} from '@nestjs/common';
+import { Request, Response } from 'express';
+
+@Catch()
+export class HttpExceptionFilter implements ExceptionFilter {
+  catch(exception: unknown, host: ArgumentsHost) {
+    const ctx = host.switchToHttp();
+    const response = ctx.getResponse<Response>();
+    const request = ctx.getRequest<Request>();
+
+    const status =
+      exception instanceof HttpException
+        ? exception.getStatus()
+        : HttpStatus.INTERNAL_SERVER_ERROR;
+
+    const message =
+      exception instanceof HttpException
+        ? exception.getResponse()
+        : 'Erro interno do servidor';
+
+    response.status(status).json({
+      statusCode: status,
+      path: request.url,
+      timestamp: new Date().toISOString(),
+      message,
+    });
+  }
+}

package/templates/prisma/src/common/guards/permissions.guard.spec.ts

@@ -0,0 +1,54 @@
+// nestforge:feature-file:rbac
+import { describe, expect, it, vi } from 'vitest';
+import { ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { Role } from '@prisma/client';
+import { Permission } from '../constants/permissions';
+import { PermissionsGuard } from './permissions.guard';
+
+function createContext(user?: { role: Role }): ExecutionContext {
+    return {
+        switchToHttp: () => ({ getRequest: () => ({ user }) }),
+        getHandler: () => ({}),
+        getClass: () => ({}),
+    } as unknown as ExecutionContext;
+}
+
+describe('PermissionsGuard', () => {
+    it('libera acesso quando a rota não exige nenhuma permissão', () => {
+        const reflector = { getAllAndOverride: vi.fn().mockReturnValue(undefined) } as unknown as Reflector;
+        const guard = new PermissionsGuard(reflector);
+
+        expect(guard.canActivate(createContext({ role: Role.USER }))).toBe(true);
+    });
+
+    it('libera acesso quando a role do usuário tem a permissão exigida', () => {
+        const reflector = {
+            getAllAndOverride: vi.fn().mockReturnValue([Permission.UserRead]),
+        } as unknown as Reflector;
+        const guard = new PermissionsGuard(reflector);
+
+        expect(guard.canActivate(createContext({ role: Role.USER }))).toBe(true);
+    });
+
+    it('bloqueia acesso quando a role do usuário não tem a permissão exigida', () => {
+        const reflector = {
+            getAllAndOverride: vi.fn().mockReturnValue([Permission.UserDelete]),
+        } as unknown as Reflector;
+        const guard = new PermissionsGuard(reflector);
+
+        expect(guard.canActivate(createContext({ role: Role.USER }))).toBe(false);
+    });
+
+    it('exige todas as permissões quando mais de uma é requisitada', () => {
+        const reflector = {
+            getAllAndOverride: vi.fn().mockReturnValue([Permission.UserRead, Permission.UserUpdate]),
+        } as unknown as Reflector;
+        const guard = new PermissionsGuard(reflector);
+
+        // MANAGER tem user:read e user:update
+        expect(guard.canActivate(createContext({ role: Role.MANAGER }))).toBe(true);
+        // USER só tem user:read
+        expect(guard.canActivate(createContext({ role: Role.USER }))).toBe(false);
+    });
+});

package/templates/prisma/src/common/guards/permissions.guard.ts

@@ -0,0 +1,28 @@
+// nestforge:feature-file:rbac
+import { CanActivate, ExecutionContext, Injectable } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { Role } from '@prisma/client';
+import { PERMISSIONS_KEY } from '../decorators/permissions.decorator';
+import { Permission } from '../constants/permissions';
+import { ROLE_PERMISSIONS } from '../constants/role-permissions';
+
+@Injectable()
+export class PermissionsGuard implements CanActivate {
+    constructor(private reflector: Reflector) { }
+
+    canActivate(context: ExecutionContext): boolean {
+        const requiredPermissions = this.reflector.getAllAndOverride<Permission[]>(
+            PERMISSIONS_KEY,
+            [context.getHandler(), context.getClass()],
+        );
+
+        if (!requiredPermissions || requiredPermissions.length === 0) {
+            return true;
+        }
+
+        const { user } = context.switchToHttp().getRequest();
+        const userPermissions = ROLE_PERMISSIONS[user?.role as Role] ?? [];
+
+        return requiredPermissions.every((permission) => userPermissions.includes(permission));
+    }
+}

package/templates/prisma/src/common/guards/roles.guard.spec.ts

@@ -0,0 +1,37 @@
+// nestforge:feature-file:rbac
+import { describe, expect, it, vi } from 'vitest';
+import { ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { Role } from '@prisma/client';
+import { RolesGuard } from './roles.guard';
+
+function createContext(user?: { role: Role }): ExecutionContext {
+    return {
+        switchToHttp: () => ({ getRequest: () => ({ user }) }),
+        getHandler: () => ({}),
+        getClass: () => ({}),
+    } as unknown as ExecutionContext;
+}
+
+describe('RolesGuard', () => {
+    it('libera acesso quando a rota não exige nenhuma role', () => {
+        const reflector = { getAllAndOverride: vi.fn().mockReturnValue(undefined) } as unknown as Reflector;
+        const guard = new RolesGuard(reflector);
+
+        expect(guard.canActivate(createContext({ role: Role.USER }))).toBe(true);
+    });
+
+    it('libera acesso quando o usuário tem a role exigida', () => {
+        const reflector = { getAllAndOverride: vi.fn().mockReturnValue([Role.ADMIN]) } as unknown as Reflector;
+        const guard = new RolesGuard(reflector);
+
+        expect(guard.canActivate(createContext({ role: Role.ADMIN }))).toBe(true);
+    });
+
+    it('bloqueia acesso quando o usuário não tem a role exigida', () => {
+        const reflector = { getAllAndOverride: vi.fn().mockReturnValue([Role.ADMIN]) } as unknown as Reflector;
+        const guard = new RolesGuard(reflector);
+
+        expect(guard.canActivate(createContext({ role: Role.USER }))).toBe(false);
+    });
+});

package/templates/prisma/src/common/guards/roles.guard.ts

@@ -0,0 +1,24 @@
+// nestforge:feature-file:rbac
+import { CanActivate, ExecutionContext, Injectable } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { Role } from '@prisma/client';
+import { ROLES_KEY } from '../decorators/roles.decorator';
+
+@Injectable()
+export class RolesGuard implements CanActivate {
+  constructor(private reflector: Reflector) {}
+
+  canActivate(context: ExecutionContext): boolean {
+    const requiredRoles = this.reflector.getAllAndOverride<Role[]>(ROLES_KEY, [
+      context.getHandler(),
+      context.getClass(),
+    ]);
+
+    if (!requiredRoles || requiredRoles.length === 0) {
+      return true;
+    }
+
+    const { user } = context.switchToHttp().getRequest();
+    return requiredRoles.includes(user?.role);
+  }
+}

package/templates/prisma/src/common/interceptors/logging.interceptor.ts

@@ -0,0 +1,23 @@
+import {
+  CallHandler,
+  ExecutionContext,
+  Injectable,
+  NestInterceptor,
+} from '@nestjs/common';
+import { Observable, tap } from 'rxjs';
+
+@Injectable()
+export class LoggingInterceptor implements NestInterceptor {
+  intercept(context: ExecutionContext, next: CallHandler): Observable<unknown> {
+    const request = context.switchToHttp().getRequest();
+    const { method, url } = request;
+    const start = Date.now();
+
+    return next.handle().pipe(
+      tap(() => {
+        const duration = Date.now() - start;
+        console.log(`[${method}] ${url} - ${duration}ms`);
+      }),
+    );
+  }
+}

package/templates/prisma/src/common/middleware/csrf.middleware.spec.ts

@@ -0,0 +1,97 @@
+// nestforge:feature-file:auth:session
+import { ForbiddenException } from '@nestjs/common';
+import { NextFunction, Request, Response } from 'express';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { CsrfMiddleware } from './csrf.middleware';
+
+describe('CsrfMiddleware', () => {
+    let middleware: CsrfMiddleware;
+    let response: Response;
+    let next: ReturnType<typeof vi.fn>;
+
+    beforeEach(() => {
+        middleware = new CsrfMiddleware();
+        response = {} as Response;
+        next = vi.fn();
+    });
+
+    function createRequest(
+        method: string,
+        sessionToken?: string,
+        headerToken?: string,
+    ): Request {
+        return {
+            method,
+            session: {
+                csrfToken: sessionToken,
+            },
+            get: vi.fn((header: string) => {
+                if (header.toLowerCase() === 'x-csrf-token') {
+                    return headerToken;
+                }
+
+                return undefined;
+            }),
+        } as unknown as Request;
+    }
+
+    it.each(['GET', 'HEAD', 'OPTIONS'])(
+        'permite o método seguro %s sem token',
+        (method) => {
+            const request = createRequest(method);
+
+            middleware.use(
+                request,
+                response,
+                next as unknown as NextFunction,
+            );
+
+            expect(next).toHaveBeenCalledOnce();
+        },
+    );
+
+    it('rejeita uma requisição sem token CSRF', () => {
+        const request = createRequest('POST');
+
+        expect(() =>
+            middleware.use(
+                request,
+                response,
+                next as unknown as NextFunction,
+            ),
+        ).toThrow(ForbiddenException);
+
+        expect(next).not.toHaveBeenCalled();
+    });
+
+    it('rejeita quando o token do header é diferente da sessão', () => {
+        const request = createRequest(
+            'PATCH',
+            'session-token',
+            'invalid-token',
+        );
+
+        expect(() =>
+            middleware.use(
+                request,
+                response,
+                next as unknown as NextFunction,
+            ),
+        ).toThrow(ForbiddenException);
+
+        expect(next).not.toHaveBeenCalled();
+    });
+
+    it('permite quando o token corresponde ao valor da sessão', () => {
+        const token = 'a'.repeat(64);
+        const request = createRequest('DELETE', token, token);
+
+        middleware.use(
+            request,
+            response,
+            next as unknown as NextFunction,
+        );
+
+        expect(next).toHaveBeenCalledOnce();
+    });
+});

package/templates/prisma/src/common/middleware/csrf.middleware.ts

@@ -0,0 +1,46 @@
+// nestforge:feature-file:auth:session
+import {
+    ForbiddenException,
+    Injectable,
+    NestMiddleware,
+} from '@nestjs/common';
+import { timingSafeEqual } from 'node:crypto';
+import { NextFunction, Request, Response } from 'express';
+
+const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
+const CSRF_HEADER = 'x-csrf-token';
+
+@Injectable()
+export class CsrfMiddleware implements NestMiddleware {
+    use(request: Request, _response: Response, next: NextFunction) {
+        if (SAFE_METHODS.has(request.method)) {
+            next();
+            return;
+        }
+
+        const sessionToken = request.session?.csrfToken;
+        const headerToken = request.get(CSRF_HEADER);
+
+        if (
+            !sessionToken ||
+            !headerToken ||
+            !this.tokensMatch(sessionToken, headerToken)
+        ) {
+            throw new ForbiddenException(
+                'Token CSRF inválido ou ausente',
+            );
+        }
+
+        next();
+    }
+
+    private tokensMatch(expected: string, received: string): boolean {
+        const expectedBuffer = Buffer.from(expected, 'utf8');
+        const receivedBuffer = Buffer.from(received, 'utf8');
+
+        return (
+            expectedBuffer.length === receivedBuffer.length &&
+            timingSafeEqual(expectedBuffer, receivedBuffer)
+        );
+    }
+}

package/templates/prisma/src/common/utils/avatar-storage.util.ts

@@ -0,0 +1,32 @@
+import { BadRequestException } from '@nestjs/common';
+import { randomUUID } from 'crypto';
+import { diskStorage } from 'multer';
+import { extname } from 'path';
+
+const ALLOWED_MIME_TYPES = ['image/png', 'image/jpeg', 'image/webp'];
+
+export const avatarStorage = diskStorage({
+    destination: './uploads/avatars',
+    filename: (_req, file, callback) => {
+        const uniqueName = `${randomUUID()}${extname(file.originalname)}`;
+        callback(null, uniqueName);
+    },
+});
+
+export function avatarFileFilter(
+    _req: unknown,
+    file: Express.Multer.File,
+    callback: (error: Error | null, acceptFile: boolean) => void,
+) {
+    if (!ALLOWED_MIME_TYPES.includes(file.mimetype)) {
+        callback(
+            new BadRequestException('Formato de imagem não suportado (use PNG, JPEG ou WEBP)'),
+            false,
+        );
+        return;
+    }
+
+    callback(null, true);
+}
+
+export const AVATAR_MAX_SIZE_BYTES = 2 * 1024 * 1024; // 2MB

package/templates/prisma/src/common/utils/hash.util.ts

@@ -0,0 +1,5 @@
+import { createHash } from 'crypto';
+
+export function sha256(value: string): string {
+  return createHash('sha256').update(value).digest('hex');
+}

package/templates/prisma/src/config/env.validation.ts

@@ -0,0 +1,49 @@
+import { z } from 'zod';
+
+const envSchema = z.object({
+  NODE_ENV: z.enum(['development', 'test', 'production']).default('development'),
+  PORT: z.coerce.number().default(3000),
+  APP_URL: z.string().url().default('http://localhost:3000'),
+  CORS_ORIGINS: z.string().min(1).default('http://localhost:5173'),
+  DATABASE_URL: z.string().url(),
+  // nestforge:feature:auth:token
+  JWT_ACCESS_SECRET: z.string().min(16),
+  JWT_ACCESS_EXPIRES_IN: z.string().default('15m'),
+  JWT_REFRESH_SECRET: z.string().min(16),
+  JWT_REFRESH_EXPIRES_IN: z.string().default('7d'),
+  // nestforge:feature:auth:token:end
+  REDIS_HOST: z.string().default('localhost'),
+  REDIS_PORT: z.coerce.number().default(6379),
+  MAIL_HOST: z.string().default('localhost'),
+  MAIL_PORT: z.coerce.number().default(1025),
+  MAIL_FROM: z.string().default('NestForge <no-reply@nestforge.dev>'),
+  GOOGLE_CLIENT_ID: z.string().optional(),
+  GOOGLE_CLIENT_SECRET: z.string().optional(),
+  GITHUB_CLIENT_ID: z.string().optional(),
+  GITHUB_CLIENT_SECRET: z.string().optional(),
+  THROTTLE_TTL: z.coerce.number().default(60),
+  THROTTLE_LIMIT: z.coerce.number().default(100),
+  // nestforge:feature:auth:session
+  ENABLE_CSRF: z
+    .enum(['true', 'false'])
+    .transform((value) => value === 'true')
+    .default('true'),
+  SESSION_SECRET: z.string().min(32),
+  SESSION_MAX_AGE: z.coerce.number().positive().default(604800000),
+  // nestforge:feature:auth:session:end
+});
+
+export type EnvConfig = z.infer<typeof envSchema>;
+
+export function validateEnv(config: Record<string, unknown>): EnvConfig {
+  const parsed = envSchema.safeParse(config);
+
+  if (!parsed.success) {
+    const issues = parsed.error.issues
+      .map((issue) => `${issue.path.join('.')}: ${issue.message}`)
+      .join('\n');
+    throw new Error(`Variáveis de ambiente inválidas:\n${issues}`);
+  }
+
+  return parsed.data;
+}

package/templates/prisma/src/database/prisma.module.ts

@@ -0,0 +1,9 @@
+import { Global, Module } from '@nestjs/common';
+import { PrismaService } from './prisma.service';
+
+@Global()
+@Module({
+  providers: [PrismaService],
+  exports: [PrismaService],
+})
+export class PrismaModule {}

package/templates/prisma/src/database/prisma.service.ts

@@ -0,0 +1,13 @@
+import { Injectable, OnModuleDestroy, OnModuleInit } from '@nestjs/common';
+import { PrismaClient } from '@prisma/client';
+
+@Injectable()
+export class PrismaService extends PrismaClient implements OnModuleInit, OnModuleDestroy {
+  async onModuleInit() {
+    await this.$connect();
+  }
+
+  async onModuleDestroy() {
+    await this.$disconnect();
+  }
+}